@gavdi/cap-mcp 1.5.1 → 1.7.0

package/README.md

@@ -29,7 +29,7 @@ By integrating MCP with your CAP applications, you unlock:
 
 - **Node.js**: Version 18 or higher
 - **SAP CAP**: Version 9 or higher
-- **Express**: Version 4 or higher
+- **Express**: Version 5 or higher
 - **TypeScript**: Optional but recommended
 
 ### Step 1: Install the Plugin
@@ -294,6 +294,40 @@ extend projection Books with actions {
 }
 ```
 
+#### Required vs Optional Parameters
+
+Parameters follow standard CDS nullability rules. A parameter declared `not null` is **required** in the MCP tool schema; a parameter without `not null` is **optional** and may be omitted by the AI agent.
+
+```cds
+@mcp: {
+  name       : 'search-items',
+  description: 'Search for items by keyword with optional filters',
+  tool       : true
+}
+function searchItems(
+  query    : String  not null,  // required — must be provided
+  category : String,            // optional — may be omitted
+  limit    : Integer,           // optional — may be omitted
+  format   : String             // optional — may be omitted
+) returns array of String;
+```
+
+The generated JSON Schema will list only `not null` parameters in the `required` array:
+
+```json
+{
+  "properties": {
+    "query":    { "type": "string" },
+    "category": { "type": "string" },
+    "limit":    { "type": "integer" },
+    "format":   { "type": "string" }
+  },
+  "required": ["query"]
+}
+```
+
+> **Note:** This behaviour applies to unbound functions and actions. Entity wrapper tools (`query`, `get`, `create`, `update`) derive nullability from the entity element definitions.
+
 #### Tool Elicitation
 
 Request user confirmation or input before tool execution using the `elicit` property:

package/lib/annotations/utils.js

@@ -236,7 +236,8 @@ function parseOperationElements(annotations, model) {
                 }
                 continue;
             }
-            parseParam(k, v);
+            const optionalSuffix = v.notNull ? undefined : "Optional";
+            parseParam(k, v, optionalSuffix);
         }
     }
     return {

package/lib/auth/utils.js

@@ -304,111 +304,112 @@ function registerOAuthEndpoints(expressApp, credentials, kind) {
     // OAuth Dynamic Client Registration discovery endpoint (GET)
     expressApp.get("/oauth/register", async (req, res) => {
         const baseUrl = (0, host_resolver_1.buildPublicBaseUrl)(req);
+        // XSUAA does not support DCR so we will respond with the pre-configured client_id
         // IAS does not support DCR so we will respond with the pre-configured client_id
-        if (kind === "ias") {
-            const enhancedResponse = {
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: req.body.redirect_uris || [
-                    `${baseUrl}/oauth/callback`,
-                ],
-            };
-            logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
-            res.json(enhancedResponse);
-            return;
-        }
+        // if (kind === "ias") {
+        const enhancedResponse = {
+            client_id: credentials.clientid, // Add our CAP app's client ID
+            redirect_uris: req.body.redirect_uris || [`${baseUrl}/oauth/callback`],
+        };
+        logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
+        res.json(enhancedResponse);
+        return;
+        // }
         // Keep original implementation for XSUAA
-        try {
-            // Simple proxy for discovery - no CSRF needed
-            const response = await fetch(`${credentials.url}/oauth/register`, {
-                method: "GET",
-                headers: {
-                    Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
-                    Accept: "application/json",
-                },
-            });
-            const xsuaaData = await response.json();
-            // Add missing required fields that MCP client expects
-            const enhancedResponse = {
-                ...xsuaaData, // Keep all XSUAA fields
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: [`${baseUrl}/oauth/callback`], // Add our callback URL for discovery
-            };
-            res.status(response.status).json(enhancedResponse);
-        }
-        catch (error) {
-            logger_1.LOGGER.error("OAuth registration discovery error:", error);
-            res.status(500).json({
-                error: "server_error",
-                error_description: error instanceof Error ? error.message : "Unknown error",
-            });
-        }
+        // try {
+        //   // Simple proxy for discovery - no CSRF needed
+        //   const response = await fetch(`${credentials.url}/oauth/register`, {
+        //     method: "GET",
+        //     headers: {
+        //       Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
+        //       Accept: "application/json",
+        //     },
+        //   });
+        //   const xsuaaData = await response.json();
+        //   // Add missing required fields that MCP client expects
+        //   const enhancedResponse = {
+        //     ...xsuaaData, // Keep all XSUAA fields
+        //     client_id: credentials.clientid, // Add our CAP app's client ID
+        //     redirect_uris: [`${baseUrl}/oauth/callback`], // Add our callback URL for discovery
+        //   };
+        //   res.status(response.status).json(enhancedResponse);
+        // } catch (error) {
+        //   LOGGER.error("OAuth registration discovery error:", error);
+        //   res.status(500).json({
+        //     error: "server_error",
+        //     error_description:
+        //       error instanceof Error ? error.message : "Unknown error",
+        //   });
+        // }
     });
     // OAuth Dynamic Client Registration endpoint (POST) with CSRF handling
     expressApp.post("/oauth/register", async (req, res) => {
         const baseUrl = (0, host_resolver_1.buildPublicBaseUrl)(req);
+        // XSUAA does not support DCR so we will respond with the pre-configured client_id
         // IAS does not support DCR so we will respond with the pre-configured client_id
-        if (kind === "ias") {
-            const enhancedResponse = {
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: req.body.redirect_uris || [
-                    `${baseUrl}/oauth/callback`,
-                ],
-            };
-            logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
-            res.json(enhancedResponse);
-            return;
-        }
+        // if (kind === "ias") {
+        const enhancedResponse = {
+            client_id: credentials.clientid, // Add our CAP app's client ID
+            redirect_uris: req.body.redirect_uris || [`${baseUrl}/oauth/callback`],
+        };
+        logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
+        res.json(enhancedResponse);
+        return;
+        // }
         // Keep original implementation for XSUAA
-        try {
-            // Step 1: Fetch CSRF token from XSUAA
-            const csrfResponse = await fetch(`${credentials.url}/oauth/register`, {
-                method: "GET",
-                headers: {
-                    "X-CSRF-Token": "Fetch",
-                    Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
-                    Accept: "application/json",
-                },
-            });
-            if (!csrfResponse.ok) {
-                throw new Error(`CSRF fetch failed: ${csrfResponse.status}`);
-            }
-            // Step 2: Extract CSRF token and session cookie
-            const setCookieHeader = csrfResponse.headers.get("set-cookie") || "";
-            const csrfToken = extractCsrfFromCookie(setCookieHeader);
-            if (!csrfToken) {
-                throw new Error("Could not extract CSRF token from XSUAA response");
-            }
-            // Step 3: Make actual registration POST with CSRF token
-            const registrationResponse = await fetch(`${credentials.url}/oauth/register`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    "X-CSRF-Token": csrfToken,
-                    Cookie: setCookieHeader,
-                    Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
-                    Accept: "application/json",
-                },
-                body: JSON.stringify(req.body),
-            });
-            const xsuaaData = await registrationResponse.json();
-            // Add missing required fields that MCP client expects
-            const enhancedResponse = {
-                ...xsuaaData, // Keep all XSUAA fields
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: req.body.redirect_uris || [
-                    `${baseUrl}/oauth/callback`,
-                ],
-            };
-            logger_1.LOGGER.debug("[AUTH] Register POST response", enhancedResponse);
-            res.status(registrationResponse.status).json(enhancedResponse);
-        }
-        catch (error) {
-            logger_1.LOGGER.error("OAuth registration error:", error);
-            res.status(500).json({
-                error: "server_error",
-                error_description: error instanceof Error ? error.message : "Unknown error",
-            });
-        }
+        // try {
+        // Step 1: Fetch CSRF token from XSUAA
+        // const csrfResponse = await fetch(`${credentials.url}/oauth/register`, {
+        //   method: "GET",
+        //   headers: {
+        //     "X-CSRF-Token": "Fetch",
+        //     Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
+        //     Accept: "application/json",
+        //   },
+        // });
+        // if (!csrfResponse.ok) {
+        //   throw new Error(`CSRF fetch failed: ${csrfResponse.status}`);
+        // }
+        // Step 2: Extract CSRF token and session cookie
+        // const setCookieHeader = csrfResponse.headers.get("set-cookie") || "";
+        // const csrfToken = extractCsrfFromCookie(setCookieHeader);
+        // if (!csrfToken) {
+        //   throw new Error("Could not extract CSRF token from XSUAA response");
+        // }
+        // Step 3: Make actual registration POST with CSRF token
+        // const registrationResponse = await fetch(
+        //   `${credentials.url}/oauth/register`,
+        //   {
+        //     method: "POST",
+        //     headers: {
+        //       "Content-Type": "application/json",
+        //       "X-CSRF-Token": csrfToken,
+        //       Cookie: setCookieHeader,
+        //       Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
+        //       Accept: "application/json",
+        //     },
+        //     body: JSON.stringify(req.body),
+        //   },
+        // );
+        // const xsuaaData = await registrationResponse.json();
+        // Add missing required fields that MCP client expects
+        //   const enhancedResponse = {
+        //     ...xsuaaData, // Keep all XSUAA fields
+        //     client_id: credentials.clientid, // Add our CAP app's client ID
+        //     redirect_uris: req.body.redirect_uris || [
+        //       `${baseUrl}/oauth/callback`,
+        //     ],
+        //   };
+        //   LOGGER.debug("[AUTH] Register POST response", enhancedResponse);
+        //   res.status(registrationResponse.status).json(enhancedResponse);
+        // } catch (error) {
+        //   LOGGER.error("OAuth registration error:", error);
+        //   res.status(500).json({
+        //     error: "server_error",
+        //     error_description:
+        //       error instanceof Error ? error.message : "Unknown error",
+        //   });
+        // }
     });
     logger_1.LOGGER.debug("OAuth endpoints registered for XSUAA integration");
 }

package/lib/mcp/utils.js

@@ -17,6 +17,10 @@ const cds = global.cds || require("@sap/cds"); // This is a work around for miss
  * @returns Zod schema instance for the given type
  */
 function determineMcpParameterType(cdsType, key, target) {
+    if (cdsType?.endsWith("Optional")) {
+        const baseType = cdsType.slice(0, -"Optional".length);
+        return determineMcpParameterType(baseType, key, target).optional();
+    }
     switch (cdsType) {
         case "String":
             return zod_1.z.string();
@@ -195,14 +199,14 @@ function buildDeepInsertZodType(targetEntityName) {
 async function handleMcpSessionRequest(req, res, sessions) {
     const sessionIdHeader = req.headers[constants_1.MCP_SESSION_HEADER];
     if (!sessionIdHeader || !sessions.has(sessionIdHeader)) {
-        res.status(400).send("Invalid or missing session ID");
+        res.status(404).json({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: "Session not found" },
+            id: null,
+        });
         return;
     }
     const session = sessions.get(sessionIdHeader);
-    if (!session) {
-        res.status(400).send("Invalid session");
-        return;
-    }
     await session.transport.handleRequest(req, res);
 }
 /**

package/lib/mcp.js

@@ -104,13 +104,13 @@ class McpPlugin {
             const sessionIdHeader = req.headers[constants_1.MCP_SESSION_HEADER];
             const sessions = this.sessionManager.getSessions();
             if (!sessionIdHeader || !sessions.has(sessionIdHeader)) {
-                return res.status(400).json({
+                return res.status(404).json({
                     jsonrpc: "2.0",
                     error: {
-                        code: -32000,
-                        message: "Bad Request: No valid sessions ID provided",
-                        id: null,
+                        code: -32001,
+                        message: "Session not found",
                     },
+                    id: null,
                 });
             }
             const session = sessions.get(sessionIdHeader);
@@ -139,13 +139,13 @@ class McpPlugin {
                 : this.sessionManager.getSession(sessionIdHeader);
             if (!session) {
                 logger_1.LOGGER.error("Invalid session ID", sessionIdHeader);
-                res.status(400).json({
+                res.status(404).json({
                     jsonrpc: "2.0",
                     error: {
-                        code: -32000,
-                        message: "Bad Request: No valid sessions ID provided",
-                        id: null,
+                        code: -32001,
+                        message: "Session not found",
                     },
+                    id: null,
                 });
                 return;
             }
@@ -163,8 +163,8 @@ class McpPlugin {
                     error: {
                         code: -32603,
                         message: "Internal Error: Transport failed",
-                        id: null,
                     },
+                    id: null,
                 });
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gavdi/cap-mcp",
-  "version": "1.5.1",
+  "version": "1.7.0",
   "description": "MCP Plugin for CAP",
   "keywords": [
     "MCP",
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@sap/cds": ">=9",
-    "express": "^4"
+    "express": "^5"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.23.0",
@@ -60,7 +60,7 @@
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
     "@types/jest": "^30.0.0",
-    "@types/node": "^24.0.3",
+    "@types/node": "^25.3.0",
     "@types/sinon": "^17.0.4",
     "@types/supertest": "^6.0.2",
     "docsify-cli": "^4.4.4",